Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.08.2, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-57232 | contao/contao, contao/core-bundle | Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module | low | 3.1 | 0% |
| CVE-2025-59014 | typo3/cms-backend | TYPO3 Bookmark Toolbar vulnerable to denial of service | medium | 0.0 | 0% |
| CVE-2025-67509 | neuron-core/neuron-ai | Neuron MySQLSelectTool “read-only” bypass via `SELECT ... INTO OUTFILE` (file write → potential RCE) | high | 8.2 | 0% |
| CVE-2022-25768 | mautic/core, mautic/core-lib | Mautic vulnerable to Improper Access Control in UI upgrade process | high | 7.0 | 0% |
| CVE-2026-46361 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ has stored XSS via | raw Filter in search.twig — html_entity_decode(strip_tags()) Bypass in Search Result Rendering | medium | 6.9 | 0% |
| CVE-2024-1851 | affiliate-toolkit-starter (WordPress plugin) | The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability che | medium | 6.3 | 0% |
| CVE-2025-70958 | intelliants/subrion | Subrion CMS vulnerable to cross-site scripting | medium | 6.1 | 0% |
| CVE-2025-29773 | froxlor/froxlor | Froxlor allows Multiple Accounts to Share the Same Email Address Leading to Potential Privilege Escalation or Account Takeover | medium | 5.8 | 0% |
| CVE-2022-3024 | simple-bitcoin-faucets (WordPress plugin) | The Simple Bitcoin Faucets WordPress plugin through 1.7.0 does not have any authorisation and CSRF in an AJAX action, allowing any authentic | medium | 5.4 | 0% |
| CVE-2025-11228 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missi | medium | 5.3 | 0% |
| CVE-2025-12877 | idonate (WordPress plugin) | The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to unauthorized modification od data du | medium | 5.3 | 0% |
| CVE-2022-45072 | wpml (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in WPML Multilingual CMS premium plugin <= 4.5.13 on WordPress. | medium | 4.3 | 0% |
| CVE-2023-3764 | woo-pdf-invoice-builder (WordPress plugin) | The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.9 | medium | 4.3 | 0% |
| CVE-2024-48901 | moodle/moodle | moodle: IDOR when fetching report schedules | medium | 4.3 | 0% |
| CVE-2024-13289 | drupal/cookiebot_gtm | This module makes it possible for you to integrate Cookiebot and Google Tag Manager in a fast and simple way. The modul | unknown | 0.0 | 0% |
| CVE-2026-55694 | snipe/snipe-it | Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover | high | 0.0 | 0% |
| CVE-2026-84920 | drupal/unpublished_node_permissions | This module creates permissions per node content type to control access to unpublished content. The module has allowed | unknown | 0.0 | 0% |
| CVE-2026-87950 | drupal/miniorange_saml | This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate throu | unknown | 0.0 | 0% |
| CVE-2024-12268 | responsive-block-editor-addons (WordPress plugin) | The Responsive Blocks – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'responsive-blo | medium | 6.4 | 0% |
| CVE-2024-5439 | blocksy (WordPress theme) | The Blocksy theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the custom_url parameter in all versions up to, and incl | medium | 6.4 | 0% |
| CVE-2023-2067 | bulletin-announcements (WordPress plugin) | The Announcement & Notification Banner – Bulletin plugin for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce va | medium | 6.3 | 0% |
| CVE-2026-23496 | pimcore/web2print-tools-bundle | Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization | medium | 5.4 | 0% |
| CVE-2025-3282 | user-registration (WordPress plugin) | The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure D | medium | 5.3 | 0% |
| CVE-2026-43880 | wwbn/avideo | AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Enables Phishing from the Site’s Legitimate From Address | medium | 5.3 | 0% |
| CVE-2024-13895 | code-snippets-cpt (WordPress plugin) | The The Code Snippets CPT plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.1.0. T | medium | 4.3 | 0% |
| CVE-2024-10815 | postlists (WordPress plugin) | The PostLists WordPress plugin through 2.0.2 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute | medium | 4.2 | 0% |
| CVE-2026-25486 | craftcms/commerce | Craft Commerce has Stored XSS in Shipping Methods Name Field Leading to Potential Privilege Escalation | medium | 0.0 | 0% |
| CVE-2026-56092 | apache-solr-for-typo3/solr | TYPO3-EXT-SA-2026-025: Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr) | unknown | 0.0 | 0% |
| CVE-2026-7886 | concrete5/concrete5 | Concrete CMS is vulnerable to IDOR in AddMessage/UpdateMessage | low | 0.0 | 0% |
| CVE-2026-50887 | shlinkio/shlink | shlink has a Server-Side Request Forgery issue | critical | 9.1 | 0% |
| CVE-2024-9598 | accelerated-mobile-pages (WordPress plugin) | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includ | high | 8.8 | 0% |
| CVE-2024-13708 | woocommerce-jetpack (WordPress plugin) | The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in versions 4.0.1 to 7.2. | high | 7.2 | 0% |
| CVE-2024-8632 | kb-support (WordPress plugin) | The KB Support – WordPress Help Desk and Knowledge Base plugin for WordPress is vulnerable to unauthorized access and modification of data d | medium | 6.5 | 0% |
| CVE-2025-3775 | woolentor-addons (WordPress plugin) | The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) plugin for WordPress i | medium | 6.5 | 0% |
| CVE-2024-13659 | listamester (WordPress plugin) | The Listamester plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'listamester' shortcode in all versions u | medium | 6.4 | 0% |
| CVE-2025-28092 | shopxo/shopxo | ShopXO Vulnerable to Server-Side Request Forgery (SSRF) via Image Upload | medium | 6.3 | 0% |
| CVE-2025-28093 | shopxo/shopxo | ShopXO Vulnerable to Server-Side Request Forgery (SSRF) via Email Settings | medium | 6.3 | 0% |
| CVE-2025-27412 | redaxo/source | REDAXO allows Authenticated Reflected Cross Site Scripting - packages installation | medium | 6.1 | 0% |
| CVE-2025-66026 | redaxo/source | REDAXO CMS is vulnerable to Reflected XSS in Mediapool Info Banner via args[types] | medium | 6.1 | 0% |
| CVE-2023-50459 | in2code/femanager | Broken Access Control in extension "femanager" | medium | 5.4 | 0% |
| CVE-2025-1033 | badgearoo (WordPress plugin) | The Badgearoo WordPress plugin through 1.0.14 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | 0% |
| CVE-2024-13901 | counter-box (WordPress plugin) | The Counter Box: Add Engaging Countdowns, Timers & Counters to Your WordPress Site plugin for WordPress is vulnerable to DOM-Based Stored Cr | medium | 4.4 | 0% |
| CVE-2022-4124 | popup-manager (WordPress plugin) | The Popup Manager WordPress plugin through 1.6.6 does not have authorisation and CSRF checks when deleting popups, which could allow unauthe | medium | 4.3 | 0% |
| CVE-2025-8889 | compress-\&-upload (WordPress plugin) | The Compress & Upload WordPress plugin before 1.0.5 does not properly validate uploaded files, allowing high privilege users such as admin t | low | 3.8 | 0% |
| CVE-2024-12683 | smart-maintenance-mode (WordPress plugin) | The Smart Maintenance Mode WordPress plugin before 1.5.2 does not sanitise and escape some of its settings, which could allow high privilege | low | 3.5 | 0% |
| CVE-2023-5551 | moodle/moodle | Moodle Exposure of Sensitive Information to an Unauthorized Actor vulnerability | low | 3.3 | 0% |
| CVE-2020-37256 | getgrav/grav | Cross-Site Scripting in Grav | medium | 0.0 | 0% |
| CVE-2026-96364 | drupal/webform | The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submissi | unknown | 0.0 | 0% |
| CVE-2024-1845 | vikrentcar (WordPress plugin) | The VikRentCar Car Rental Management System WordPress plugin before 1.3.2 does not have CSRF checks in some places, which could allow attack | high | 8.8 | 0% |
| CVE-2026-34737 | wwbn/avideo | AVideo: Arbitrary Stripe Subscription Cancellation via Debug Endpoint and retrieveSubscriptions() Bug | medium | 6.5 | 0% |